375929d06743ac752a8b5fcc0582c04a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

375929d06743ac752a8b5fcc0582c04a_JaffaCakes118
Size

133KB
MD5

375929d06743ac752a8b5fcc0582c04a
SHA1

7693296f3b6290dec70dd0f517a56aeff31abea8
SHA256

6d7cba00d8eabd6b7d9e6d17a00019bc57ca11ef1c0ad123b021087eefc57f65
SHA512

06523e1ec34fdbeb5e0649fc119121a56d649a6c6ac69e0cdbff534b28e7f603ce48d92f21f89b2bbb5c81084842228eb94fe3bd71493b1ce3883d45b836a765
SSDEEP

3072:EbaSsOPK63JbgY4iE/ccvDhEYJEwH9tlDRMMWOAKxXS1myP4c:E+ZW3P4iEU0KkrDMMm1mm4c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
375929d06743ac752a8b5fcc0582c04a_JaffaCakes118

Files

375929d06743ac752a8b5fcc0582c04a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

38549d35c51cf8c61ebf86f52d8a5370

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

RpcBindingFromStringBindingA
RpcBindingSetAuthInfoA
NdrClientCall
RpcStringBindingComposeA
RpcStringFreeA

kernel32

ClearCommBreak
ExitProcess
ClearCommBreak
CreateProcessW
EnumResourceNamesW
ExitProcess
QueryPerformanceCounter
GetStartupInfoA
GetExitCodeProcess

user32

GetMessageA
PostThreadMessageA
KillTimer
SetTimer
CharUpperA
PeekMessageA

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ